2019

vBulletin before 5.5.4 allows clickjacking.

vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories.

REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values.

KSLabs KSWEB 3.93 allows ../ directory traversal, as demonstrated by the hostFile parameter.

A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute ar

sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.

rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source.

rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which

rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain length values because of reuse of a variable. This may open u

IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive infor

Smart cards from the Athena SCS manufacturer, based on the Atmel Toolbox 00.03.11.05 and the AT90SC chip, contain a timi

MatrixSSL 4.2.1 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or a remot

wolfSSL and wolfCrypt 4.0.0 and earlier (when configured without --enable-fpecc, --enable-sp, or --enable-sp-math) conta

Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update

A vulnerability in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager

In JetBrains YouTrack through 2019.2.56594, stored XSS was found on the issue page.

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Mana

A vulnerability in Cisco Unified Contact Center Express (UCCX) Software could allow an unauthenticated, remote attacker

An issue was discovered in JetBrains TeamCity 2018.2.4. It had several XSS vulnerabilities on the settings pages. The is

JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection.

JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to ge

UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Mana

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Mana

A vulnerability in the web-based management interface of Cisco IC3000 Industrial Compute Gateway could allow an authenti

A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remo

A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remo

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Mana

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Mana

A vulnerability in the web-based interface of multiple Cisco Unified Communications products could allow an unauthentica

A vulnerability in the file and malware inspection feature of Cisco Firepower Management Center (FMC) Software could all

A vulnerability in the configuration of the Pluggable Authentication Module (PAM) used in Cisco Firepower Threat Defense

A vulnerability in the Clientless SSL VPN (WebVPN) portal of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower

A vulnerability in the command line interface (CLI) of Cisco Firepower Threat Defense (FTD) Software could allow an auth

A vulnerability in the Secure Copy (SCP) feature of Cisco Adaptive Security Appliance (ASA) Software could allow an auth

A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an

A vulnerability in the Secure Sockets Layer (SSL) VPN feature of Cisco Adaptive Security Appliance (ASA) Software could

A vulnerability in the web-based guest portal of Cisco Identity Services Engine (ISE) could allow an unauthenticated, re

Server metadata could be exposed because one of the error messages reflected the whole response back to the client in Je

EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file.

IBM Security Directory Server 6.4.0 discloses sensitive information to unauthorized users. The information can be used t

IBM Security Directory Server 6.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Moja

Online Store System v1.0 delete_product.php doesn't check to see if a user authtenticated or has administrative rights a

Vulnerability in Online Store v1.0, The registration form requirements for the member email format can be bypassed by po

Vulnerability in Online Store v1.0, stored XSS in admin/user_view.php adidas_member_email variable

Vulnerability in Online Store v1.0, Stored XSS in user_view.php where adidas_member_user variable is not sanitized.

An issue was discovered in XunRuiCMS 4.3.1. There is a stored XSS in the module_category area.

emlog through 6.0.0beta allows remote authenticated users to delete arbitrary files via admin/template.php?action=del&tp

JetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality